Insight Cookie Banner

Lightweight opt-in cookie consent banner with cache-safe tracker blocking and Google Consent Mode v2 support.

Description

Shows an Accept / Decline / Close consent banner and gates tracking scripts until the visitor accepts.

• Opt-in blocking — tracker scripts (including snippets hard-coded in the theme) are neutralized server-side to type="text/plain" and only activated after the visitor accepts. Runtime guards (createElement, fetch, XHR, sendBeacon, Image, iframes, MutationObserver) catch dynamically injected trackers.
• Cache-safe — the HTML output is identical for every visitor; all consent decisions happen client-side, so full-page caching can never serve the wrong variant.
• Google Consent Mode v2 — gtag('consent', 'default', ...) is injected as the first script in <head>. By default Google tags (gtag.js / GTM) load cookieless with denied signals, preserving conversion modeling; a settings toggle switches to hard-blocking them instead.
• Consent signals — accepting or declining fires gtag('consent', 'update', ...), a icb_consent_update dataLayer event for GTM triggers, and fbq('consent', 'grant'/'revoke').
• Cookie purge — declining removes non-necessary cookies (e.g. _ga, _fbp) across domain variants.
• JS API — window.ICB.show() / accept() / decline() / getConsent() for custom "cookie settings" links.

Filters: icb_blocked_tracker_patterns, icb_necessary_cookies, icb_enable_output_buffer.

Changelog

2.0.2

• fix: exclude inline Google tag scripts from WP Rocket delayed JS — the 2.0.1 patterns matched only scripts carrying a googletagmanager/google-analytics URL, so the inline snippet calling gtag('config', ...) stayed delayed and Google Analytics never initialised for visitors who did not interact with the page

2.0.1

• fix: register rocket_delay_js_exclusions so WP Rocket stops delaying banner.js — the banner's hidden attribute was never removed, leaving visitors unable to consent until they scrolled or clicked, which blocked _gcl_aw and broke Google Ads conversion attribution
• feat: icb_delay_js_exclusions filter to customise the exclusion patterns

2.0.0

• feat: opt-in model — trackers are blocked until the visitor accepts (previously blocked only after decline)
• feat: cache-safe architecture — identical HTML for all visitors, consent evaluated client-side
• feat: server-side output rewrite neutralizes hard-coded tracker script tags to text/plain
• feat: Google Consent Mode v2 defaults + settings toggle (advanced mode by default)
• feat: dataLayer icb_consent_update event and fbq('consent', ...) on accept/decline
• feat: runtime guards extended to sendBeacon, iframes, createElement('img'); accept re-activates scripts without reload
• feat: window.ICB public JS API; Close now dismisses for the session only
• fix: blocklist narrowed to fbevents.js / facebook.com/tr so FB Login, embeds, and Messenger keep working
• fix: no more console errors from blocked XHR/fetch; createElement options argument and Image.prototype preserved

1.1.0

• Initial release: banner with Accept/Decline/Close, decline-only tracker blocking, cookie purge on decline